{"report_id":"3a1ef322-ad2f-4b2a-87af-2acbf6ff02c6","version":0,"status":"done","tags":[],"date":"2026-08-25T21:01:48Z","url":{"schema":"http","addr":"getultraiso.ru/","fqdn":"getultraiso.ru","domain":"getultraiso.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"final":{"url":{"schema":"https","addr":"getultraiso.ru/","fqdn":"getultraiso.ru","domain":"getultraiso.ru","tld":"ru"},"title":"UltraISO — скачать программу для работы с ISO-образами","dom":{"size":11853,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, Unicode text, UTF-8 text, with very long lines (2790)","md5":"b98be3e6518c6af31272e97f2f99cc11","sha1":"e6ff9aaa01a36d3d32ddcc55dce16b6994425bb2","sha256":"3f595aa08512854df470e42b1a283612af521efdc2cf755d4d14c6da127344e2","sha512":"35e18375c732164c9a153e41bddbf83a6b0955b8065d35115f55552691f9658dad4c3b81c3e745c09548e026c011972ade5f5dce7bb11ab9ac33f53f5d22543f","ssdeep":"192:TrtiF/7MWeics3cfIi02qYQV9HDl0JKBKC4MeRFwxK0v:Tra/7MW0sMf1qYXcKC4XRF9+","tlshash":"9b32762394c434bf5202669eec15b60e39b785ffce675a5162bc2c5d67f38208b2a41f","dom_hash":"domhash9e2765d1de94d9302562e0abff2ba0b8","first_seen":"2026-08-25T20:57:07.434307Z","last_seen":"2026-08-25T21:11:18.144928Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"getultraiso.ru/","fqdn":"getultraiso.ru","domain":"getultraiso.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":0,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-09-29T21:01:48Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":2}},"detection":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"getultraiso.ru","ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"domain_registered":"2026-08-14","domain_rank":0,"first_seen":"2026-08-25T20:57:03.479892Z","last_seen":"2026-08-25T20:57:03.479892Z","alert_count":14,"request_count":7,"received_data":149127,"sent_data":3357,"comment":"","tags":null,"fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":[{"url":{"schema":"https","addr":"getultraiso.ru/","fqdn":"getultraiso.ru","domain":"getultraiso.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":true,"md5":"fe57e2a5887a2bf807671686afd4ff1d","sha1":"2796d7f449eb5c6dc95e4f7a4ee90a79ec5bff8a","sha256":"b9d4fe759507da48dd99f1dd261359c9d02101b4015e3fd4145f3ebbb781f725","sha512":"ce311bb3d6bd0f0d13739aea2c929f672942fb1692f4e852da6b75cef1e1cb5c1c8d8d2852d53c323561b55e6f3d09ec3c88a707c6692ebc6ee79e06ecb7a649","ssdeep":"","tlshash":"baf0e1b7bc8892b5c2f62131532ba31c712718ba20896c38894d8895397ac59102fd6d","size":576,"data":"","first_seen":"2026-08-25T20:57:07.460844Z","last_seen":"2026-08-25T21:11:18.157415Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"getultraiso.ru/assets/app.js","fqdn":"getultraiso.ru","domain":"getultraiso.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"introduction_type":"scriptElement","is_inline":false,"md5":"681c13551ff029d23842f26f76666d38","sha1":"9663ce287007598cf6a6cff4244d6cfd8e1c3b33","sha256":"06debbbb06b41e1af52b860c5f6b9e1e164968976a7063ed6634a8a3743ae26d","sha512":"bf60e043aa4b02bb2090f9166923a37e433bf2f7954cc1e65c5e9a066a7cbee96a59784bd8fcf8a05eaa9a65b74f440ceb5a8693bedec8eaea62317bc8bf432d","ssdeep":"192:/t4IgEj0/kQfWkiVA0PUOOAqz707ynVlz:162NZPUJH0Gn3","tlshash":"9012852455a4257644bb53bfeb879548fbb100bba40281107e6c5f493ff1d2283baee9","size":9238,"data":"","first_seen":"2026-08-25T20:57:07.437945Z","last_seen":"2026-08-25T21:11:18.154437Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"getultraiso.ru/assets/icons.svg","fqdn":"getultraiso.ru","domain":"getultraiso.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"other","requested_by":"https://getultraiso.ru/","date":"2026-08-25T21:01:21.584Z","timestamp":1787691681584,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getultraiso.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:18 GMT","end":"Mon, 16 Nov 2026 20:09:17 GMT"},"fingerprint":{"sha1":"88:B7:39:C4:84:50:F1:30:AF:A3:81:FB:9F:8B:74:8A:1E:54:D2:5E","sha256":"48:F7:63:89:D5:21:20:C9:E5:11:2E:BC:76:84:27:58:4A:1F:E2:3B:33:B7:9B:22:C9:D8:F1:93:C3:16:74:7D"}}},"request":{"raw":"GET /assets/icons.svg HTTP/1.1\r\nHost: getultraiso.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getultraiso.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: same-origin\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:21 GMT\r\ncontent-type: image/svg+xml\r\ncontent-length: 575\r\nlast-modified: Fri, 14 Aug 2026 08:54:37 GMT\r\netag: \"8b4-658fdf866feb9-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":2228,"size_decoded":987,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"c1d052927586e6fd208d4b0fddd3679a","sha1":"d3e53bcb9b18ac1b3d4801f8954aa481c1b4eb96","sha256":"5c3187ac4b4c4ed104fed02e48866296e2a7947ac9b2fff611011de1c0452021","sha512":"0d00ea067d9729e82623a25a8b85868edbcd5abb192f826e5fb3c843584dacbfcaf9a6b959da38a5dd6e8aefadcc86b2c383219d296df66261c4450fa61ec73c","ssdeep":"","tlshash":"ad412a1a67191d3cf863417ae328727a507f63c72b4d212ca82d153a674579ef83bbc8","first_seen":"2026-08-25T20:57:07.452255Z","last_seen":"2026-08-25T21:11:18.148536Z","times_seen":3,"resource_available":false,"data":null}},"time_used":52,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":52,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getultraiso.ru/favicon.png","fqdn":"getultraiso.ru","domain":"getultraiso.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getultraiso.ru/","date":"2026-08-25T21:01:21.640Z","timestamp":1787691681640,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getultraiso.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:18 GMT","end":"Mon, 16 Nov 2026 20:09:17 GMT"},"fingerprint":{"sha1":"88:B7:39:C4:84:50:F1:30:AF:A3:81:FB:9F:8B:74:8A:1E:54:D2:5E","sha256":"48:F7:63:89:D5:21:20:C9:E5:11:2E:BC:76:84:27:58:4A:1F:E2:3B:33:B7:9B:22:C9:D8:F1:93:C3:16:74:7D"}}},"request":{"raw":"GET /favicon.png HTTP/1.1\r\nHost: getultraiso.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getultraiso.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:21 GMT\r\ncontent-type: image/png\r\ncontent-length: 1755\r\nlast-modified: Fri, 14 Aug 2026 08:54:34 GMT\r\netag: \"6db-658fdf835fae7\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":1755,"size_decoded":2164,"mime_type":"image/png","magic":"PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced","md5":"491c04fb73088ce39487f3f5942729a3","sha1":"a1090732493746b944e70ce76c289a741a3060b4","sha256":"0050d982a4e07d39a453e5fe838166963c2e719dfc5440cb1083afc0b5a89b8a","sha512":"bfb24a473f5db7accc5d751aae5f2bf19fce542bbbef3f914e12caf881ecfb0ae442d0a1da895b0ddd03fe188e94e74ec8e69ef47c402f245f30820c858438f5","ssdeep":"","tlshash":"2a312bd1e3f5406b87e2f688512ed469667700a08078238312e9f9690114a02b3bdbb7","first_seen":"2026-08-25T20:57:07.449519Z","last_seen":"2026-08-25T21:11:18.150304Z","times_seen":3,"resource_available":false,"data":null}},"time_used":36,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":36,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getultraiso.ru/","fqdn":"getultraiso.ru","domain":"getultraiso.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-08-25T21:01:20.848Z","timestamp":1787691680848,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getultraiso.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:18 GMT","end":"Mon, 16 Nov 2026 20:09:17 GMT"},"fingerprint":{"sha1":"88:B7:39:C4:84:50:F1:30:AF:A3:81:FB:9F:8B:74:8A:1E:54:D2:5E","sha256":"48:F7:63:89:D5:21:20:C9:E5:11:2E:BC:76:84:27:58:4A:1F:E2:3B:33:B7:9B:22:C9:D8:F1:93:C3:16:74:7D"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: getultraiso.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:21 GMT\r\ncontent-type: text/html\r\ncontent-length: 3647\r\nlast-modified: Fri, 14 Aug 2026 08:54:34 GMT\r\netag: \"2fa5-658fdf8395e27-gzip\"\r\naccept-ranges: bytes\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=0, must-revalidate\r\nstrict-transport-security: max-age=31536000\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]},{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":12197,"size_decoded":4108,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (2790), with CRLF line terminators","md5":"51fbf2fd6b489ea11eee1af8a628e8b8","sha1":"5712f32b9f87dee44597b874a1e7fe2a63310cb1","sha256":"2cb6020a1ae8f44f6ceaa6328994c304249b11d34e12be1ff38541a29a29343e","sha512":"c71877723a104064d01b7659a393f70a943b0fb9e0c47dc47d76d6d7648718596aaf6fddaf87f2eb5a6a5af2b600b439432366fb101e545d351aa9e1dbcacaaf","ssdeep":"192:tiYia3i02c20Z79HPi0lSIKC4MeRFwxKtfw:uc20LPKC4XRF9q","tlshash":"b932642254c4346f5213669eec15b74d78b781fece676a1132bc295f7bf38208b2b41a","first_seen":"2026-08-25T20:57:07.455318Z","last_seen":"2026-08-25T21:11:18.15193Z","times_seen":3,"resource_available":false,"data":null}},"time_used":216,"timings":{"blocked":-1,"dns":88,"connect":35,"send":0,"wait":53,"receive":0,"ssl":40},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getultraiso.ru/assets/styles.css","fqdn":"getultraiso.ru","domain":"getultraiso.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"stylesheet","requested_by":"https://getultraiso.ru/","date":"2026-08-25T21:01:21.261Z","timestamp":1787691681261,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getultraiso.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:18 GMT","end":"Mon, 16 Nov 2026 20:09:17 GMT"},"fingerprint":{"sha1":"88:B7:39:C4:84:50:F1:30:AF:A3:81:FB:9F:8B:74:8A:1E:54:D2:5E","sha256":"48:F7:63:89:D5:21:20:C9:E5:11:2E:BC:76:84:27:58:4A:1F:E2:3B:33:B7:9B:22:C9:D8:F1:93:C3:16:74:7D"}}},"request":{"raw":"GET /assets/styles.css HTTP/1.1\r\nHost: getultraiso.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/css,*/*;q=0.1\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getultraiso.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: style\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=2\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:21 GMT\r\ncontent-type: text/css\r\ncontent-length: 4309\r\nlast-modified: Fri, 14 Aug 2026 08:54:38 GMT\r\netag: \"4024-658fdf86b7b3f-gzip\"\r\nvary: Accept-Encoding\r\ncontent-encoding: gzip\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":16420,"size_decoded":4770,"mime_type":"text/css","magic":"Unicode text, UTF-8 text, with very long lines (1824), with CRLF line terminators","md5":"8b10d4d5766570053e6cb0c847b2e610","sha1":"dc3642ac9ff4342090bf3e3601b148583c049f2e","sha256":"e9a67da5ab70b8dbbaf968cd935d0e36c58a9caeac601d4c241efa895ac4218e","sha512":"0d4ce4fdb5c89126a0dacb066e140cae550ac87f2e7a423703ef4c68f3a984e5ba1505bac437f663dc23b84ec4ced9762d77c30be5836b8e9e34d3aae78026ab","ssdeep":"384:SZe3fRZv4+YeIWVZMMRNOsO9c6INT+V7ub:me3fcWVvic6jMb","tlshash":"bc72a6b26264713cfa2be565e6d5969e7210e113d83307e4ee82e754c1c76f3167070e","first_seen":"2026-08-25T20:57:07.458285Z","last_seen":"2026-08-25T21:11:18.15322Z","times_seen":3,"resource_available":false,"data":null}},"time_used":50,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":50,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getultraiso.ru/assets/app.js","fqdn":"getultraiso.ru","domain":"getultraiso.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://getultraiso.ru/","date":"2026-08-25T21:01:21.262Z","timestamp":1787691681262,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getultraiso.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:18 GMT","end":"Mon, 16 Nov 2026 20:09:17 GMT"},"fingerprint":{"sha1":"88:B7:39:C4:84:50:F1:30:AF:A3:81:FB:9F:8B:74:8A:1E:54:D2:5E","sha256":"48:F7:63:89:D5:21:20:C9:E5:11:2E:BC:76:84:27:58:4A:1F:E2:3B:33:B7:9B:22:C9:D8:F1:93:C3:16:74:7D"}}},"request":{"raw":"GET /assets/app.js HTTP/1.1\r\nHost: getultraiso.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getultraiso.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:21 GMT\r\ncontent-type: text/javascript\r\nvary: Accept-Encoding\r\nlast-modified: Sat, 22 Aug 2026 14:00:40 GMT\r\netag: W/\"2416-659a32da79125\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":9238,"size_decoded":3648,"mime_type":"text/javascript","magic":"JavaScript source, Unicode text, UTF-8 text, with CRLF line terminators","md5":"681c13551ff029d23842f26f76666d38","sha1":"9663ce287007598cf6a6cff4244d6cfd8e1c3b33","sha256":"06debbbb06b41e1af52b860c5f6b9e1e164968976a7063ed6634a8a3743ae26d","sha512":"bf60e043aa4b02bb2090f9166923a37e433bf2f7954cc1e65c5e9a066a7cbee96a59784bd8fcf8a05eaa9a65b74f440ceb5a8693bedec8eaea62317bc8bf432d","ssdeep":"192:/t4IgEj0/kQfWkiVA0PUOOAqz707ynVlz:162NZPUJH0Gn3","tlshash":"9012852455a4257644bb53bfeb879548fbb100bba40281107e6c5f493ff1d2283baee9","first_seen":"2026-08-25T20:57:07.437945Z","last_seen":"2026-08-25T21:11:18.154437Z","times_seen":3,"resource_available":true,"data":null}},"time_used":48,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":48,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getultraiso.ru/assets/images/logo.webp","fqdn":"getultraiso.ru","domain":"getultraiso.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getultraiso.ru/","date":"2026-08-25T21:01:21.271Z","timestamp":1787691681271,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getultraiso.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:18 GMT","end":"Mon, 16 Nov 2026 20:09:17 GMT"},"fingerprint":{"sha1":"88:B7:39:C4:84:50:F1:30:AF:A3:81:FB:9F:8B:74:8A:1E:54:D2:5E","sha256":"48:F7:63:89:D5:21:20:C9:E5:11:2E:BC:76:84:27:58:4A:1F:E2:3B:33:B7:9B:22:C9:D8:F1:93:C3:16:74:7D"}}},"request":{"raw":"GET /assets/images/logo.webp HTTP/1.1\r\nHost: getultraiso.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getultraiso.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:21 GMT\r\ncontent-type: image/webp\r\ncontent-length: 10036\r\nlast-modified: Fri, 14 Aug 2026 08:54:39 GMT\r\netag: \"2734-658fdf87f80a2\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":10036,"size_decoded":10448,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"f937b45f3e1d65684a85f97d7aeb6c70","sha1":"b2140fc33aadaa012cc6a28a41b9db35b0f78f3e","sha256":"1e49a6266fd4344e1b9faf43b78e9d2486feec7e523d6e58068659f4e2a5f216","sha512":"c3e7afb55a820461abc45f16ab3512cba0320ef3a20c433d5b9b5b5c6e9125a77a240a5019d06d7eeb34522a2aaba1ad4f204bea632fa047045eac09e9cdf4c1","ssdeep":"192:x/ZV4wCgo2emDMmjSMLnnHgrdzlOlCq0qsxKmSRkLN3FSyH58QdO:how8wDMO7HykVDKyklHm8O","tlshash":"3c22ad740da2da3afe95c624f46c503ed0d7e7085d4eb86e7cf918e268a29a44c20612","first_seen":"2026-08-25T20:57:07.441943Z","last_seen":"2026-08-25T21:11:18.155654Z","times_seen":3,"resource_available":false,"data":null}},"time_used":73,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":73,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"getultraiso.ru/assets/images/hero.webp","fqdn":"getultraiso.ru","domain":"getultraiso.ru","tld":"ru"},"ip":{"addr":"185.26.122.8","port":443,"asn":62082,"as":"Hostland LTD","country":"Russia","country_code":"RU"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://getultraiso.ru/","date":"2026-08-25T21:01:21.273Z","timestamp":1787691681273,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"www.getultraiso.ru","organization":""},"issuer":{"commonName":"YR1","organization":"Let's Encrypt"},"validity":{"start":"Tue, 18 Aug 2026 20:09:18 GMT","end":"Mon, 16 Nov 2026 20:09:17 GMT"},"fingerprint":{"sha1":"88:B7:39:C4:84:50:F1:30:AF:A3:81:FB:9F:8B:74:8A:1E:54:D2:5E","sha256":"48:F7:63:89:D5:21:20:C9:E5:11:2E:BC:76:84:27:58:4A:1F:E2:3B:33:B7:9B:22:C9:D8:F1:93:C3:16:74:7D"}}},"request":{"raw":"GET /assets/images/hero.webp HTTP/1.1\r\nHost: getultraiso.ru\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://getultraiso.ru/\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Tue, 25 Aug 2026 21:01:21 GMT\r\ncontent-type: image/webp\r\ncontent-length: 94264\r\nlast-modified: Fri, 14 Aug 2026 08:54:38 GMT\r\netag: \"17038-658fdf8763975\"\r\nx-content-type-options: nosniff\r\nreferrer-policy: strict-origin-when-cross-origin\r\ncache-control: public, max-age=31536000, immutable\r\nstrict-transport-security: max-age=31536000\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"HSTS","description":"HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS.","website":"https://www.rfc-editor.org/rfc/rfc6797#section-6.1","common_platform_enumeration":"","icon":"","categories":["Security"]}],"data":{"size":94264,"size_decoded":94677,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image, VP8 encoding, 1350x900, Scaling: [none]x[none], YUV color, decoders should clamp","md5":"6ee4394f4b111e280f799f895d43a654","sha1":"dc13cd9a742f8cdc0a79b83acf57a79245ad18f2","sha256":"695c0769a7928af189c5f6b227e8f89bf864653ba0b470787aa2a177b6f4bafb","sha512":"9d39b2bd7fc2027fe3310c0d55be30a9b454578f7be67f9b809859ad67a7310117818e51db95b8080bbd1adf771bda54b09b481b204ac1c014e6251136055c8e","ssdeep":"1536:3RjFcwZjgQIz1m7Ns5VmoAPxgTZQcRqmDpWxkhcssR8II8J+8DEL/+IkDnx7RCD0:hJn3W1mS/mzKTZQzMpOOcs68IfJ+qELA","tlshash":"649313e19bd2ec5accd9e1f69de51d853fec78085b1c256dc81e08676b52a734013ac3","first_seen":"2026-08-25T20:57:07.44587Z","last_seen":"2026-08-25T21:11:18.156596Z","times_seen":3,"resource_available":false,"data":null}},"time_used":140,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":72,"receive":68,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-08-25","alert":"Sinkholed","trigger":"getultraiso.ru","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}